Controlled Folder Access Policy Modification

This guide will provide background information on modifying an existing controlled folder access folder path.

Controlled Folder Access

Malicious applications have always had an eye for valuable documents. From ransomware to data exfiltration, many of the most detrimental attacks on an organization involve attaining access to data and changing the status of its confidentiality or availability. Using controlled folder access, we can restrict access to folders containing sensitive information to those applications which are either trusted or explicitly allowed, reducing the risk of new/untrusted applications from gaining access to these files.

Role Requirements

Procedure Scope: Administrators

Required Group Membership: Admin.Security

Handbook Reference

Package: Device Security

Domain: Attack Surface Reduction Management

Modifies: Controlled Folder Application Exclusions

Modifying a Device Controlled Folder Access Rule

1. Navigate to the Attack Surface Reduction – Intune portal, locate and select the policy you wish to alter.
   
2. Upon selecting the rule, scroll down to the Properties section; all the information of the rule will be displayed. Four points of interest will be available to Edit. You can modify the sections as needed.
   
   1. Basics: Adjusts non-functional items of the rule, such as the Name or Description of the rule.
      
   2. Assignments: Specifies which Groups will be included or excluded from rule enforcement.
      
   3. Scope Tags: Specifies which administrators will have access to the viewing and altering this object.
      
   4. Configuration Settings: Displays the security settings for the Attack Surface Reduction Rules profile type that are currently enabled or disabled and being applied to the associated devices specified in the Assignments section. We will be worried about two specific settings Enabled Controlled Folder Access and Controlled Folder Access Protected Folders. Modifications can vary from disabling either settings or changing the folder path listed under Controlled Folder Access Protected Folders.
   
3. Regardless of which section is selected to be Edited, the same redirect to the Edit Policy page will be displayed. The first page will display the selected sections current configuration and will allow you to make the necessary adjustments (additions, removals, editing, etc.) The second page will be the Review section where you will finalize the changes. Once the necessary adjustments have been configured for the selected section select Next to continue to the modification finalization stage.
   
4. Once on the revisions page, if all the necessary adjustments look correct, select Save to finalize the modification process.